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(57) Abstract: The present invention is a network switch that main- 
tains a relatively lightly loaded state, and at the same time protects 
the network servers from DOS and DDOS attacks. The switch main- 
tains a very large table of LP addresses where it stores information 
such as the number of incompleted and completed connections from 
each address. Using this information, the switch classifies each ad- 
dress into a threat level: unknown, trusted, suspicious, and malicious. 
Each threat level is treated differently allowing the switch to provide 
efficient access to the server while maintaining security. Connection 
to the server is denied to clients classified as malicious while trusted 
clients are passed through to the server. Suspicious connections are 
proxied while unknown connection treatment may be set by the user. 
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